A variety of design flaws make this simple hack possible. Via arstechnica
The first is a lack of adequate encryption. A key based on a four-digit PIN is woefully inadequate. Apple provides a function namedfor producing random bytes that can be used to generate secure keys. “If this was used to encrypt the Digital Driver's Licence rather than the 4 digit PIN, it would make the task of brute-forcing much harder if not completely infeasible for attackers,” Farmer wrote.
The third shortcoming is that using the “pull-to-refresh” function—a cornerstone of the DDL verification scheme intended to ensure the most current information is showing—fails to refresh any of the data stored in the electronic credential. Instead, it updates only the QR code. A better response would be for the pull-to-refresh function to download the latest copy of the DDL from the ServiceNSW database.
“When an unsuspecting victim scans the fraudster’s QR code, everything will check out, and the victim won't know that the fraudster has combined their own identification photo with someone's stolen Driver's Licence details,” Farmer explained. Had the system returned the legitimate image data, the scanning party would easily see that the fraudster had forged the DDL, since the face returned by Service NSW wouldn’t match the face displayed on the app.
Malaysia Latest News, Malaysia Headlines
Similar News:You can also read news stories similar to this one that we have collected from other news sources.
Forget Vegetables: Research Shows Eating Fruit More Frequently Could Reduce DepressionAston University study found frequent fruit eaters had greater positive mental well-being. People who frequently eat fruit are more likely to report greater positive psychological well-being and are less likely to report symptoms of depression compared to those who do not, according to new resear
Read more »
Crypto Skeptics to Hold Own Conference in September | CoinMarketCapConfirmed topics include crypto's impact on the environment, celebrities who endorse digital assets, and the connections that have been forged between football clubs and crypto projects.
Read more »
You'll get hooked on this Tucson art exhibitionCanadian blacksmith Matt Jenkins spent a leap year forging 366 hooks, one a day.
Read more »
Exclusive — President Giammattei: U.S. Divided on Abortion While Guatemala Strives to Be Pro-LifeGuatemalan President Alejandro Giammattei is forging ahead with an unwavering pro-life posture in his country while the issue of abortion is at centerstage in the United States.
Read more »